CA Comodo used broken OCR and issued certificates to the wrong people

Re:CA Comodo used broken OCR and issued certificates to the ... by robryk on Friday October 21, 2016 @12:19PM (#12761679)

Have a self-signed CA certificate with a longish expiration and sign the actual keys the webservers use with that. Apply TOFU to that CA certificate (on a per-domain basis).

There's IIRC no mechanism for that, but for the single-domain CA key it'd make sense to sign the new one with the old one.

[ Parent | on HN ]

Re:CA Comodo used broken OCR and issued certificates to the ... by 45h34jh53k4j on Friday October 21, 2016 @12:40PM (#12761919)

TOFU is bad for the web. Its is much easier to MiTM https vs ssh. Many vendors will sell your enterprise kit to do it to all users.

There will be some jurisdictions where MiTM is always and unavoidable. TOFU can't work here.

These things must be universal, and TOFU can never be universal.

[ Parent | on HN ]